EUVD-2026-105485
GHSA-j87h-fmf7-grww
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Extensions
-
ExecutionReclaim freed memory with controlled data
-
ImpactExecute arbitrary code within sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use an affected Google Chrome desktop build prior to 156.0.8078.47 and to actively visit or render attacker-controlled crafted HTML (CVSS UI:R), so a user-interaction step gates the attack - there is no fully automatic, no-click path. No authentication is required (PR:N) and the attacker needs no prior access to the target. The key limiting factor is sandbox containment: the description states code executes 'inside the sandbox' with scope unchanged (S:U), so a successful trigger alone does not compromise the host OS or other sites' data without an additional sandbox-escape vulnerability. Users on auto-updating Chrome channels who have already received 156.0.8078.47 or later are not exploitable. |
| Impact | Signals are largely consistent and point to a genuine, patch-worthy browser flaw of moderate real-world severity. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated bug that requires user interaction (visiting a crafted HTML page). However, the description explicitly limits code execution to 'inside the sandbox' and the vector keeps S:U (scope unchanged) - meaning this is NOT a confirmed sandbox escape, so the practical impact is bounded by Chrome's renderer/extensions sandbox unless chained with a second escape bug. Google/Chromium rated the security severity only 'Medium', which tempers the 8.8 CVSS High rating and reflects the sandbox-contained impact. No EPSS score, no SSVC decision, no KEV listing, and no public POC are present in the input, so there is no evidence of active or imminent exploitation. Net: a legitimate patch-now item for browser fleets given Chrome's ubiquity and the low exploitation complexity, but not an emergency - the absence of KEV/POC and the sandbox containment argue against treating it as actively weaponized. Note the signal tension: CVSS High (8.8) vs. vendor 'Medium' severity - the discrepancy is explained by sandbox containment, not a data error. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML/JavaScript that triggers the use-after-free in Chrome's Extensions component when a victim with a vulnerable Chrome build (prior to 156.0.8078.47) visits it. The freed-then-reused memory is manipulated to achieve arbitrary code execution within the browser sandbox. No public exploit code was identified at time of analysis, and real-world damage would typically require chaining a separate sandbox-escape to affect the host. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's Extensions subsystem enables remote code execution inside the renderer sandbox when a victim opens attacker-controlled crafted HTML, affecting desktop builds prior to 156.0.8078.47. The attack is unauthenticated over the network but requires user interaction (CVSS UI:R), and because the scope is unchanged (S:U), the code execution is contained by the browser sandbox - full host compromise would need a separate sandbox escape. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) on record; risk is moderated by Chrome's auto-update cadence, since users already on 156.0.8078.47 or later are not exploitable.
RemediationAI
Vendor-released patch: 156.0.8078.47 - upgrade Google Chrome to version 156.0.8078.47 or later, as announced in the stable channel advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html); the standard auto-update flow will deliver it, but the browser must be relaunched for the new build to take effect, so verify the version at chrome://settings/help and confirm the restart happened. For managed fleets, force the update through the Google Update / Chrome Browser Cloud Management policies (UpdateDefault, or a pinned target version in your software deployment tool) and audit endpoint version inventory for any host still below 156.0.8078.47, since a lingering out-of-date install is the only precondition an attacker needs. Where patching cannot be completed immediately, reduce exposure by tightening the extension surface rather than assuming detection will catch the trigger: apply ExtensionInstallAllowlist/ExtensionInstallBlocklist policies or block extension installation and unpacked extension loading for standard users, which shrinks the attack surface but breaks legitimate extension-dependent workflows and may break line-of-business extensions; alternatively, confine high-risk browsing to a separate hardened browser profile or a virtualized/remote-rendered session that is discarded after use, accepting the operational overhead and user-experience cost. Do not rely on the browser sandbox as the sole mitigation - it limits this bug to in-sandbox code execution, not host compromise - and note that no public exploit code has been identified at time of analysis, so generic web-filtering signatures are not a dependable control. Track the Chromium issue (https://issues.chromium.org/issues/495899355) for any update to exploitability status.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-416 (Use After Free), a memory-safety defect in the Extensions component of the Chromium browser, the subsystem that parses manifests, hosts background/service-worker logic, and brokers extension API calls between renderer processes and the browser process. A freed object is reused after its lifetime ends, letting an attacker who controls HTML rendered in a Chrome tab corrupt memory and redirect execution - reported by Google's own chrome-cve-admin@google.com as a Chromium security severity Medium issue, tracked as Chromium issue 495899355. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H describes a remotely reachable, low-complexity, unauthenticated attack that nonetheless needs the victim to visit or render the crafted page; the unchanged scope (S:U) reflects that the resulting code execution is confined to the sandboxed renderer, so confidentiality/integrity impact is scored against the browser context rather than the underlying operating system. No CPE strings were supplied in the intake data; the authoritative version boundary comes from the vendor advisory and EUVD record, which enumerate Chrome builds below 156.0.8078.47.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via crafted page (AV:N/AC:L), no auth (PR:N) but requires visiting a page (UI:R); code runs inside sandbox so scope unchanged (S:U) with high C/I/A within that process.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome desktop builds prior to 156.0.8078.47 contain a high-severity use-after-free in the Extensions subsystem that can allow crafted web content to execute code within the renderer sandbox when a user opens attacker-controlled HTML. The primary organizational exposure is unmanaged or delayed-update endpoints, especially for high-risk users who browse untrusted content, though renderer code execution is contained by Chrome's sandbox and full host compromise would require a separate sandbox escape. No public exploit identified at time of analysis, and the vendor-released fix is Chrome 156.0.8078.47, so leadership should prioritize rapid update verification across the desktop fleet.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB